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The captioned investigation, involves intrusions into computers within-the United States 
which began around January 13, 1998, and continuing to date. The computers which have been 
compromised are computers belonging to the United States Air Force, located at Andrews AFB, 
Maryland, Kirkland AFB, New Mexico, Columbus AFB, Ohio, Lackland AFB, Texas, Gunter 
AFB, Alabama, and Channel Island, ANGS, California; computers belonging to the United 
States Navy, located at the United States Naval Academy in Annapolis, Maryland, Pearl Harbor, 
Hawaii and computers belonging to the United States Marine Corps Base, Camp Butler, 
Okinawa, Japan. 

Most of the compromised computers are Domain Name Servers (DNS), i.e. fbi.gov. DNS 
systems are responsible for translating domain names into their respective Internet Protocol(IP) 
addresses. IP addresses are essential for Internet computer communications. Intrusions into such 
computers have the potential to disrupt the mission of the U.S. military throughout the world. 


From logs obtained from various Internet service providers and universities, investigators 
have determined that the intruder(s) originated from SONIC.N ET an Intern et service provider, in 


Santa Clara, California. 

Court Orders served on revealed that 
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On February 9,1998, the Massachusetts Institute of Technolog y (MIT)| | 

contacted SONIC.NET regarding a computer intrusion. _ 

| at MIT, stated that someone had intruded their system from SONIC.NET and 
provided the Internet Protocol (IP) address. The IP address is known to be associated withf 

IDOBI I 


be 

b7C 


account 


On February 16,1998, electronic surveillance w as initiated by the FBI on the user 
The Order was signed on 
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are subjects of this investigation and are associates. 

Another site identified as a “launchi ng point” for the intrusions is Maroon.com, a web 
publisher located at College Station , Texas. and 

a search warrant has been served for 

A trap and trace Order was signed and executed on | I 

I 1 A trap and trace Order is already in place for_ 


On |FBI SF initiated a Title III Order on A Title III Order is now 

being pursued for Additionally ] | are also being obtain for each 

subject. 

To date, 15 court orders have been served to include one Title III and two consensual 
monitoring sites. Two more orders are presently being obtained to include another Title III. 

_This matter is being coordinated with_DOJ, DOD, and others as new 

developments arise. Referral/consult 

K.M. 
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File Number(s): 288-HQ-1242560 (Pending) 

Title: SOLAR SUNRISE; 

CITAC MATTERS; 

00: HQ 




Synopsis: Following is the status of WFO's involvement in this 

investigation as of 2/24/98. 

Reference: EC dated 2/17/98 to Houston Division. 


Details: 

288-WF-211047 


]U.S. NAVY - VICTIM; OO: WFO". 


SA 


is coordinating all investigative 


activity with Agents of the Naval Criminal Investigative Service 
(NCIS) based in both Washington, D.C. and Jacksonville, Florida. 
Trap & Trace/pen register installation still problematic. The 
subject's current whereabouts and employment are known. 
Coordination with the NC IS Agents will continue. Remote 
monitoring at 
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__ continuing. Intrusions through IAP.NET 

into MIT will be addressed by NCIS only. 

288-HQ-1242560 "SOLAR SUNRISE: CITAC MATTERS: OO: HQ" 


Copies of 

CART were blank. Original evidence in the hands of 


co pied at FBIHQ 
SSA 


' Iis following through to resolve. |_|related to the 

[account to be copied tomorrow by FBIHQ CART per CITAC. 


Access to account originated from the University of Phoenix, 
online.uops.fo.uophx.edu." WFO will follow through. 

bo 

1 b7C 

b?E 

Referral/Consult 








